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[57] ABSTRACT 

A document processing system in which a server subsystem 
stores information corresponding to a document containing 
human readable and machine readable information and a 
client subsystem receives the document and interprets the 
machine readable information. The client subsystem con- 
tacts the server to verify validity of information in the 
document using a communications network that allows 
information to be exchanged between the server and the 
client. 
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METHOD AND APPARATUS FOR 
DOCUMENT VERIFICATION AND 
TRACKING 



FIELD OF THE INVENTION 

The present invention relates to the field of document 
verification and tracking; more particularly, the present 
invention relates to tracking, control, authentication and 
verification of paper and electronic documents. 

BACKGROUND OF THE INVENTION 

Many documents have to be authenticated to verify or 
prove the validity of the information they contain. For 
example, legal contracts, drivers licenses, passports, and the 
like, all require some proof of authenticity to be considered 
valid. Often this burden rests on the bearer of the document 
Common forms of proof include signatures, holograms, 
seals, etc., which depend on their difficulty of reproduction 
to prevent forgery. Therefore, these documents themselves 
include some level of proof of authenticity. 

For example, drug prescriptions in the United States that 
allow patients to purchase controlled substances are usually 
written on a doctor's letterhead, and include the doctor's 
signature and identification number, as well as the name and 
type of medicine to be purchased. Thus, a prescription 
typically consists of a printed out portion (e.g., letterhead, 
etc.) and the filled-in portion (often handwritten), and proof 
that a prescription is authentic may be based on the fact that 
both the letterhead of the document and the signatures are 
difficult to reproduce. 

Documents may be altered, however, with such alter- 
ations being extremely difficult to detect. For prescriptions, 
the printed portion and the filled-in portion are visually 
distinct, thereby making it easy to "change" or alter the 
filled-in portion. For instance, with prescriptions, unscrupu- 
lous individuals can (and do) "white out" the written pre- 
scription and then photocopy the blank form. At that time, a 
different prescription may then be written in on these forms 
for their own desired drugs, so that large quantities of 
substances may be obtained through legitimate pharmacies. 
Therefore, even though documents may include some form 
of proof of authenticity, a document may not contain valid 
data. It is desirable to provide a system that is able to prove 
or verify document authenticity, while providing a more 
reliable means of ascertaining the necessary proof. 

Data networks, covering both local areas or larger areas 
(e.g., global), exist providing communication capabilities 
over various distances. Such networks allow users at remote 
locations to access desired data and communicate with other 
remote locations or central hub-like areas. One such network 
is employed in credit card verification. 

Credit cards are verified through the use of machine 
readable technology that allows a credit card to be inserted 
and read by a verification machine. Upon sliding the card 
through the machine, the card is read and a database is 
accessed by which it is determined whether the card is valid 
and whether the amount to be charged comes under the 
available limit of the card The database may be located 
nearby or at some other central location. However, these 
systems do not authenticate printed or written data on paper 
documents. 

The present invention provides a system that supports 
verification of paper documents, including their authenticity 
with respect to the information contained thereon. The 
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present invention has a number of applications, with one 
particular application being prescription verification and 
tracking. The present invention provides a system of com- 
bining the filled-in portion of a prescription (or other form) 
5 with the printed portion. 

SUMMARY OF THE INVENTION 

A document processing system is described. The docu- 
iQ ment processing system of the present invention includes a 
server subsystem storing information corresponding to a 
document containing human readable and machine readable 
information. Also included in the document processing 
system is a client subsystem that receives the document and 
i5 interprets the machine readable information. Using infor- 
mation on the document the client subsystem contacts the 
server to verify validity of information in the document The 
contact between the server subsystem and the client sub- 
system is accomplished using a communications network 
2Q that allows information to be exchanged between the server 
and the client 

BRIEF DESCRIPTION OF THE DRAWINGS 

The present invention will be understood more fully from 
23 the detailed description given below and from the accom- 
panying drawings of various embodiments of the invention, 
which, however, should not be taken to limit the invention 
to the specific embodiments, but are for explanation and 
understanding only. 
30 FIG. 1 is a block diagram of one embodiment of a 
document processing system of the present invention. 

FIG. 2 is a flow chart of the process of the present 
invention. 

35 FIG. 3 illustrates one embodiment of the prescription 
system of the present invention. 
FIG. 4A illustrate a portion of the document 
FIG. 4B illustrates a magnified version of the document of 
FIG. 4A. 

40 FIG. 4C illustrates the magnified version of the document 
of FIG. 4A unchanged in content, but shifted from its 
original position in FIG. 4A to a new position closer to the 
right and upper borders. 

FIG. 4D illustrates the magnified version of the document 
45 of FIG. 4A changed. 

FIG. 4E illustrates the magnified version of the document 
of FIG. 4A that is unchanged in content but rotated 90 
degrees with respect to its original position in FIG. 4A. 
50 FIG. 4F illustrates the magnified version of the document 
of FIG. 4A that is unchanged in content but is rotated 180 
degrees (i.e., flipped over) with respect to its original posi- 
tion in FIG. 4A. 
FIG. 5A the tokens within a block. 
55 FIG. SB illustrates the tokens within a "changed" block 
located at the same position with respect to the document as 
the block in FIG. 5A. 

FIG. 5C tabulates same shape values associated with the 
token located beneath the cross-hair in FIG. 5A. 

60 

FIG. 5D tabulates same shape values associated with the 
token located beneath the cross-hair in FIG. SB. 

DETAILED DESCRIPTION OF THE PRESENT 
INVENTION 

65 

A document verification and tracking system with special 
applications to drug prescription disbursement is described. 
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In the following detailed description of the present invention descriptions, and tracking information for all documents the 
numerous specific details arc set forth in order to provide a author creates (e.g., publishes). Database management soft- 
thorough understanding of the present invention. However, ware may be included in the server subsystem 101 to 
it will be apparent to one skilled in the art that the present coordinate access and operation of document storage 101A. 
invention may be practiced without these specific details. In 5 Communications facilities 10 IB are includes for handling 
other instances, well-known structures and devices are requests from clients to verify the authenticity and inform a- 
showa in block diagram form, rather than in detail, in order tion of a document Intelligent processing 101C is also 
to avoid obscuring the present invention. included in the server subsystem 101 to allow the server to 
Overview of the Document Verification and Tracking Sys- reduce the information exchange that is necessary for veri- 
tem 10 fication. The intelligent processing 101 C may also produce 
FIG. 1 is a block diagram of one embodiment of the updated documents, if any are available, or prevent docu- 
document verification and tracking system of the present ments from being verified again. The intelligent processing 
invention. It will be understood that while FIG. 1 is useful 101C of the server subsystem 101 may prevent documents 
for providing an overall description of the system of the from being *te-verified" by removing them from the docu- 
present invention, a number of the details of the system are 15 ment storage 101A. 

not shown. As necessary for the disclosure of the present The server subsystem 101 may also include a print engine 

invention, further detail is set forth with reference to the 101D that creates hard copy images of documents to be 

other figures provided with this specification. published. The print engine 101D may include software 

As is illustrated in FIG. 1, the system, as may be utilized running on a computer system to print out the machine 

by the present invention, generally comprises a server sub- 20 readable information, such as bar codes. Note that in one 

system 101 and a client subsystem 102. The server sub- embodiment these images may be electronic images. Each 

system 101 and the client subsystem 102 are coupled image includes a machine readable portion and a human 

together using a data network. Although the system of the readable portion. The machine readable portion is an 

present invention is shown with only one server subsystem encoded version of information about the document (e.g., 

and only one client subsystem, other configurations having 25 information in the human readable portion), and in one 

multiple servers and/or multiple clients may be possible. embodiment may include a unique identifier, version 

The document verification and tracking system of the number, date, and other relevant information (e.g., a drug 

present invention allows the bearer of a document to dem- name for a prescription). In one embodiment, the machine 

onstrate the authenticity of the document to a third party. The readable information is a 2D barcode. The machine readable 

system of the present invention uses machine readable 30 information may be encrypted. The print engine 101D may 

information (e.g., digital information) printed on paper not be included in the server subsystem 101 where the 

documents as part of the verification process. The machine documents are created separately from the server subsystem 

readable information is specific to the document allowing it 101 and entered into the server subsystem 101 after their 

to be tracked. creation. 

In one embodiment, the server subsystem 101 provides 35 The server subsystem 101 may be implemented as a 

two main functions. First, the server subsystem 101 is computer system, in hardware and/or software. For instance, 

responsible for creating a paper document with both human document storage 101A may comprise the main memory 

readable and machine readable information. The machine (e.g., a random access memory (RAM) or other dynamic 

readable information on the paper document corresponds, in storage device) or hard disk storage of the computer system, 

part, to the human readable information on the paper docu- 40 The communication facilities 101B may include hardware 

ment. Second, the server subsystem 101 maintains an elec- and/or software in the computer system that enable com- 

tronic version of the paper document for use in verification munication over a data network (e.g., a modem) as well as 

and document tracking. The client subsystem 102 receives perform queries. The intelligent processing 101C may be 

the paper document and using the information contained in include a processor in the computer system executing 

the document contacts the server subsystem 101 via the 45 instructions from memory. The print engine 101D may 

network 103. The server subsystem 101 uses its archived include the processor of the computer system cooperating 

electronic version and indicates to the client subsystem with a printer or hardcopy peripheral in the computer 

whether the document contains valid information. That is, system. 

the server subsystem 101 verifies the validity of the docu- The computer system of the server subsystem 101 may 

ment and the information it contains. 50 also include a bus or other communication means 101 for 

The authenticity verified by the server subsystem 101 in communicating information between the various compo 
rcsponsc to information sent by the client subsystem 102 ncnts and devices, a read only memory (ROM) and/or other 
may include a determination as to whether the information static storage device 106 coupled to bus 101 for storing static 
contained on the paper document is valid. The system of the information instruction for intelligent processing 101C, and 
present invention uses the machine readable information to 55 a data storage device 107 such as a magnetic disc or optical 
determine whether a change has been made to the human disc and its corresponding disc drive, and input/output 
readable information. Such a change might have been made peripherals. These input/output peripherals may include a 
by the bearer of the document (e.g., an unscrupulous pre- display device, such as a cathode ray tube (CRT) or liquid 
scription modification). Thus, the present invention provides crystal display (LCD) for displaying information to a com- 
for tracking between the human readable information and 60 puter user. An alphanumeric input device, including alpha- 
the machine readable information on the paper document. In numeric and other keys, may also be included in the server 
addition to verification, the system of the present invention subsystem 101 for communicating information and corn- 
may also support version control and automatic forms mand selections to the communications facilities 101B, 
processing. intelligent processing 101C, and the print engine 101D. An 

The server subsystem 101 is maintained by each indi- 65 additional user input may include a cursor control, such as 

vidual author of printed documents. The server subsystem a mouse, a trackball, stylist, trackpad or other cursor direc- 

101 comprises document storage 101A for storing copies, tion keys, for communicating direction information and 
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command selections to the intelligent processing and for 
controlling cursor movement on a display included within a 
server. 

System users (e.g., merchants, pharmacists, etc.) desiring 
to verify documents use the client subsystem 102. The client 5 
subsystem 102 includes a scanner 102Afor scanning docu- 
ments. The scanner 102A scans the encoded information. In 
one embodiment, the scanner 102A also scans other human 
interpretable information of the document. In one 
embodiment, client subsystem 102 may include recognition 10 
software/hardware (e.g., hand writing recognition) to inter- 
pret information on the document, such as signatures. The 
client subsystem 102 also includes intelligent processing 
102B and communication facilities 102C that enable the 
client subsystem 102 to contact the server subsystem 101 15 
based on the information scanned in order to verify the 
document The communications facilities 102C transmit and 
receive signals from one or more server subsystems. The 
communications facilities 102C may include query software 
that receives data, deciphers data, searches and responds to 20 
queries from the server subsystem 101. In one embodiment, 
the client subsystem 102 comprises a computer system 
similar to that of the server subsystem 101 with additional 
scanning software and hardware. 

The server subsystem 101 and the client subsystem 102 25 
are interconnected with a global network such as a digital 
network (e.g., Internet). Note that the system of the present 
invention may be implemented using telephone or ISDN 
networks. The choice of the network depends on the speed 
desired or obtainable to the users. 30 
Operation of the System 

The present invention operates by having an electronic 
version of each document available for verifying and track- 
ing a printed document In the present invention, each author 
of such a document (e.g., doctor) maintains a server, such as 35 
server subsystem 101. An electronic version of the docu- 
ment is stored in document storage, along with descriptions 
and tracking information. Thus, all documents that are 
created have a corresponding record stored for use in veri- 
fication. For instance, if the author is a doctor, the descrip- 40 
tions for all prescriptions provided by the doctor may be 
maintained in the document storage portion of the server 
subsystem 101. 

The document is generated using the print engine 101C of 
the server subsystem 101 and includes an encoded region or 45 
image portion. In one embodiment, the present invention 
combines printed portions of a prescription with filled- in 
portions to create a document with a spatially indistinguish- 
able block (encoded region). 

In one embodiment, the encoded information includes a 50 
unique identifier, version number, date and other relevant 
information to identify the printed human readable portion 
of the document Other information may indicate the name 
of a drug, a prescription dosage, patient's name, doctor's 
name, the current holder of the document and the address of 55 
the verifying server. The other inforrnation may include 
location information indicating where human interpretable 
or other pertinent information is contained on the document, 
which will be used to identify the authenticity/validity of the 
document is contained. This location information is referred 60 
to herein as "on" pixels. The information may be encoded 
using existing encoding methods, such as bar coding, and 
may be encrypted as well. 

Each user or merchant (e.g., pharmacist) who desires to 
verify a document uses the client subsystem 102. The client 65 
subsystem 102 is similar conceptually to a credit card 
verification machine. That is, the client subsystem 102 uses 



6 

a scanner or similar device to read the encrypted information 
on the document. Based on that inforrnation, the client 
subsystem contacts the server subsystem of the author of the 
document (e.g., server subsystem 101) via the network and 
asks (the server subsystem) to verify the authenticity of the 
document 

Contact may be performed by reading an address from the 
document, decoding the address, and then using the address 
and generating a request for verification to the server sub- 
system. The communication facilities of the server sub- 
system handles the requests from client subsystems. 

After contact has been made, verification may occur. 
Verification may include scanning more parts of the image 
and communicating them to the server subsystem. The 
amount and type of information needed in order to satisfy 
the server subsystem that a particular document is indeed the 
one indicated by the machine readable identifier is depen- 
dent on the particular document and the level of confidence 
desired. In one embodiment, it may be necessary to provide 
other information scanned from other portions of the docu- 
ment in order to perform verification. The client subsystem 
would send this information to the server subsystem. Using 
this information, the server subsystem compares the 
encoded information with the human readable information 
on the document If the server subsystem determines that a 
discrepancy exists between the two, then the server sub- 
system indicates that the document is not authentic and its 
information may be invalid. 

Note that each server subsystem may have its own criteria 
for determining the amount or level of discrepancy that is 
allowed before a conclusion of inauthenticity or invalidity is 
reached. Furthermore, the criteria may be defined in terms of 
manipulatable (e.g., tunable) parameters. Using these 
parameters, the confidence associated with a "no change" 
determination can be set 

When the machine readable channel is too small to carry 
all the relevant information, pyramidal decomposition may 
be used to localize and focus on discrepancies at a minimum 
of communications costs. For instance, if a forger adds a 
zero to change 200 mg prescription to 2000 mg, there would 
be a mismatch between the bar code and the pixel informa- 
tion versions and the present invention could detect it 

Although a document is authentic, the server subsystem 
may communicate updated information to the client sub- 
system. The updated information may include a new version 
of the document Other information may be transmitted to 
the client subsystem, including but not limited to, queries, 
scheduling requests, and any information which the author 
desires the bearer of the document to know. The client may 
communicate information, such as response from filled in 
boxes on the form, to the server subsystem. 

Furthermore, the client may contact additional servers in 
order to facilitate transaction processing. For example, a 
pharmacy client may contact the patient's insurance server 
to obtain payment information. Billing information sent to 
the patient' s insurance company, and so forth, could include 
the encrypted information (e>g., bar codes), allowing quick 
and easy access for coordination of billing information from 
remote sites. This will be particularly useful in tracking 
down disputes and billing errors, and obtaining accurate, 
up-to-date billing information. 

After verification, the server subsystem may prevent 
future authorizations. This may be accomplished by remov- 
ing the document from document storage and/or providing 
an indication that the document has already been verified 
previously. This information may also help in record keep- 
ing. For instance, doctors would be able to detcrrnine if a 
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patient has indeed filled a prescription, which is very impor- the document as a means for detennining if a change has 

tant when dealing with very old and forgetful patients and occurred to the document The pixel information may 

especially when life preserving drugs are involved. include the number of pixels located in a certain portion 

The process of the present invention is summarized in the (e.g., block) of the document. In one embodiment, the pixel 

flow chart in FIG. 2. Referring to FIG. 2, initially the 5 information may include the location on the document of the 

document is created having both human readable and pixels that are to undergo change detection (e.g., * 4 on" pixels, 

machine readable information (processing block 201). An i oca tions where entries are supposed to be written or printed, 

electronic version of the document is stored in the ^cument ctc ) M well as information Aout me pixels to enable a 

storage of the server subsystem (processing block 202 . The server of ^ nt inventioil to determine if a change has 

rocS P blS 2 a 03) &VCD mdmd41a1 ' c ' g * 10 occurred to that portion of the document. 

P ^?some^t m if time thereafter, the document is scanned * one e ^diment the encryption is accomplished using 

by a client subsystem seeking to verify the documents m a com P uter * one 1 embcx ^ e,lt ' * e 

authenticity (processing block 204). The client subsystem f 0 *"™ encryption is provided by exclusive-ORing the 

interprets the machine readable information (processing imtial data with a pseudo-random sequence generated using 

block 205) and contacts the server subsystem requesting 15 a sccrct key as a seed. Note that in this case, the decryption 

verification (processing block 206). The server subsystem performed by the client subsystem is simply exclusive- 

verifies the information on the document (processing block ORing the data with the same pseudo-random sequence. 

207), possibly confirming the documents validity, confirm- Note that this type of encryption process is not perfectly 

ing billing/insurance information, transferring funds, and/or secure method of data encryption because of the short key 

preventing future authorizations. 20 length used to seed pseudo-random sequences and the fact 

The Prescription Process of the Present Invention that the same key is likely to be used on more than one 

The present invention may be used with prescriptions for message. There are well-known methods to attack this type 

drugs and medicines. FIG. 3 illustrates such an application. of encryption. 

Referring to FIG. 3, a physician uses a server subsystem to In order to obtain secure data through encryption, a one 

generate a prescription 302 — a piece of paper containing the 25 time pad can be employed in place of the pseudo-random 

name of the drug, dosage, patient name, physician's name sequence, A one time pad comprises a series of randomly 

an d an identifier in both human and machine readable form, generated bits that are known to both parties (ie., the 

An electronic copy is stored on a server subsystem 301, "encrypting" party and the "decrypting" party) and is only 

while a physical paper is given to the patient In one used once in the encryption process. In a one time pad, the 

embodiment, the physician uses a personal digital assistant 30 key length is equal to the message length and may be more 

(PDA) to enter the prescription, along with other medical than 100,000 bits. Since the one time pad is used once, it is 

records. not susceptible to the same attacks which are used on 

The patient takes the prescription to the pharmacy where pseudo-random sequences, 

the prescription is scanned by a client subsystem 303 by the In another embodiment, encryption processing could be 

pharmacist (or an individual assisting the pharmacist). The 35 performed using the digital encryption standard (DES) or the 

client subsystem 303 interprets the machine readable inf or- RSA algorithm In the RSA algorithm, digital data is 

mation 304 using, for instance, a scanner, and, using that encrypted using two prime numbers which are multiplied 

information, contacts the physician* s server subsystem via a together, as is well-known in the art In the case where each 

data network (e.g., World Wide Web, Internet etc.). The of the two prime numbers has approximately 200 digits, the 

server subsystem 301 confirms that the prescription 302 is 40 RSA algorithm offers a very secure encryption method. Note 

valid, that it has not already been filled, and that no new/ that to use DES in one of the feedback modes or to use the 

conflicting prescriptions or instructions have been issued to RSA algorithm, it is necessary that errors do not occur in the 

this patient encoding and decoding of the digital data stream If an error 

Based on this authorization from the server subsystem occurs, any information beyond the location of the error 
301, the client (e.g., pharmacist) fills the prescription 302 45 would be lost It should be noted that any digital encryption 
and the server subsystem 301 marks the prescription as method may be employed with the present invention, 
having been filled, preventing future authorizations. The In one embodiment, the decryption process requires the 
pharmacy client 303 may also contact the server subsystem use of the same key used during encryption. By using the 
305 operated by the insurance company or the patient, based same key, the original data is recreated, 
on information encoded on the prescription 302, a card 50 When the methods of encryption (and decryption) of the 
carried by the patient, or available from the physician's present invention are being integrated into the processes of 
server 301. The insurance server 305 verifies the insurance the present invention, the present invention also provides 
and billing information for the patient, possibly even trans- data information to be transferred on a portion of the plain 
ferring funds to the pharmacist paper in a manner which preserves its privacy and/or auth en- 
Encryption 55 tication. In the present invention, this privacy can easily be 

In one embodiment, encryption and decryption are used in obtained through the use of a key or code known to the 

the present invention. The machine readable portion of the user(s) when encryption and decryption of a document 

paper document contains encrypted information to ensure occurs, 

security. During the verification process, the client sub- Document Change Detection 

system must decrypt the information. In one embodiment, 60 In one embodiment, it is necessary to insure that no 
the machine readable portion of the document is encrypted change has been made to a document The present invention 
using bar codes. In another embodiment, the document is provides a method for determining whether a Meaningful" 
encrypted using a technique described in U.S. Pat. No. change has been made in the pixel representation of a printed 
5,337362, entitled "Method and Apparatus for Placing Data (e.g., paper) document containing text, business graphics, 
onto Plain Paper," issued Aug. 9, 1994. 65 etc The procedure and apparatus for the document change 
In another embodiment, pixel information regarding the detection of the present invention enables security by pro- 
document is encoded into the machine readable portion of viding correspondence between machine readable informa- 
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tion (e.g., a bar code) and the human interpretable informa- present invention, FIG. 4A illustrates a sample image. In this 

tion it accompanies. case, the sample image shown in FIG. 4A is a portion of a 

The document change detection procedure of the present scanned W4 form. The sample image is divided into mul- 

invention relies on a checksum (a scalar measure of the pixel tiple blocks, one of which is shown magnified in FIG. 4B. 
distribution) over blocks. The method of the present inven- 5 FIGS. 4C-4F illustrate the magnified portion of FIG. 4B 

tion is sensitive to changes, but relatively insensitive to unchanged in content but is shifted in an (X,Y) direction 

random noise. In other words, the function used in the (jq@ changed where a 7 replaces the 6 (FIG. 4D), 

present invention will not flag an error under typical copier ro tated 90° to the left (FIG. 4E), and rotated 180° (FIG. 4F). 

variation, but is sensitive to deliberate alteration. Note ^ t ^ nG ^ ±c original image is shifted to a 

The method of the present invention employs two tunable ^ ^ fa doMa> tQ &e rf ht afld borders 

parameters: the total number of cells and a tolerance for ^ the B1(X± QieckSum function is evaluated for the 

match within any cell. In one embodiment, these tunable blockg ^ nGS 4J ^ 4p ^ resulti gcalar number 

parameters control the level of confidence regarding the (checksum) ^ identical for ±e blocks ta 4B> 4Cf 4E 

presence or absence of a change in the document To achieve and ^ whjlc ^ rcsult for ±c blo(± ^ mQ 4D is ^cnt 

a higher confidence, greater side channel information may j5 ^ invention ^ ^ block where 

i CqU ui D the 7 is replaced by 6 since it has a different CheckSum 

Tunable Parameters numb but wm not a false tf ^ block is 

An image I is initially tessellated into (MxN) blocks. The merely shifted or rotated 
tesseUation of an image is a process weU-known to those ^ 5 ^ ^ ^ bloc]Q ^ &e same loca . 

slaUedmUieart.A(MNxl)ttec^ 2Q ti ons * ^ differing images along with their feature values, 

measure ^ document content Each element of C is a ^ ed dctcctcd each bbck ^ approxirnatcd by 
tuncuonal (C,) called the Block CheckSum Measure, a chaill 0 f polygonal boxes (tokens) denned by a width (w) 
a Ju . o w and a height (h). The difference between the upper images 

The Block CheckSum Measure (blod£s) is detected by computing the average of the abso- 

In overview , the method of the jpresent mvenUon divides lute values of aU me 'log^f-hW* 
the document into a number of blocks, and computes for & 
each block a scalar quantity that would be changed if the ( h 

document is altered The pixel distribution within each block I log — 

is first transformed into a set of 'tokens," which in this case 

o^r^ 30 v^esforai^ 

original images (FIGS. 4B and 4D, respectively) trans- ™ c lower row "J ™- 5 sh ™ s mc sha ^ valucs com P Uted 
formed into a chain of connected polygons (tokens), each at ^ ons *<T d ^s-hairs 
with an associated height and width Lfi 1 one embodiment of Thepresent mventon provides for cheap verifiable docu- 
med g orithr*M,N,and^ „ ments bas * on existing hardware such as laser printers and 

degrekTTien^toeachblcckb^l^NmmanmiageLa 35 ^annersj^e present mvention akoaUows document dato- 
- - & bases to be distnbuted and under author control. Each author 

is free to set up their own criteria for authenticity, which may 
be document dependent, and monitor the use of each of the 
VJfceJC^T vm ^^' other documents, and provide timely updates to clients. 

40 Audit trails, both electronic and paper, may be generated. In 

. t _ , . , the present invention, documents may change hands or 

where i is a token-index, J,- is the number of tokens in the fonns ( e i ectr0 nic to paper) several times, and still be 
block l, A/ is the scalar real-numbered value of the kth verifiable 

feature of the jth token, and a* is a weighting function that ^ lamaak alsQ be t0 ^ 

determines the relative weights of K different features. 45 syste ^ bcsi des prescription verification. The system of the 
Using the above equation, various features may be t invention ^d u a cor ^ e ^ 

computed,inciudmgbutnotbimtedtowidm,height,perm^ ^ owing patrons to obtam documents, possibly 

eter and aspect-ratio. . , ■ . . scanning in their library card for authentication. Legal 

For example, a symmetric aspect-ratio function A,- is officcs could usc ^ pfcscnt invcntion t0 control access to 
denned as: 50 documents and maintain version iiiforrnation. Each docu- 

[rnent would include encrypted information (e.g., 2D bar 
log ( -L ) 1 f code) which encodes, among other things, information about 

^ WJ ' J ' who can make copies of the document Intelligent copiers 

would then require an authentication code or card before 
where hj and w, denote the height and width, respectively, 55 permitting the duplication of a document Lists of who has 
the jth token. The Block CheckSum function is obtained seen/copied the document may also be maintained by the 
using the above-referenced CheckSum equation. Note that server subsystem. 

the scalar variable a* is used to weight the importance of The server subsystem of the present invention could also 
different features. Since only one feature was used in tins maintain version control of documents, preventing a docu- 
cxample, a*^a l =l and 60 ment from being simultaneously modified in conflicting 

ways by multiple authors. 
C i= -L £ Automated forms processing could also be supported by 

1 v ^ /l the system of the present invention. The client subsystem 

could be used to contact a server subsystem, verify a 
In this example, C„ in the Block QieckSum function, 65 particular form, and identify any discrepancies with the 
reduces to the mean aspect ratio function. FIGS. 4A-4F and original, such as the filled in portions. This new information 
FIG. 5 illustrate the document change detection of the could be forwarded to the server subsystem for processing. 



CheckSum C, value is computed according to the equation: 
1 
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Furthermore, a catalog could include these 2D bar codes client subsystem and providing responses to the client 

or other machine readable indicia, so that a customer need subsystem using the network, 

only circle the desired items to order them. 11. The system defined in claim 1 wherein the commu- 

Whereas, many alterations and modifications of the nications network comprises the Internet 

present invention will no doubt become apparent to a person 5 12. The system defined in claim 10 further comprising a 

of ordinary skill in the art after having read the foregoing processing unit coupled to the client subsystem for provid- 

description. it is to be understood that the particular embodi- ing an updated version of the document in response to a 

ment shown and described by way of illustration are in no request 

way to be considered limiting. Therefore, reference to the 13. The system defined in claim 10 further comprising a 
details of various embodiments are not intended to limit the to processing unit coupled to the server subsystem for prcvent- 
scope of the claims which themselves recite only those ing the server subsystem from responding to requests con- 
features regarded as essential to the invention. cerning the document 

Thus, a document verification and tracking system has 14. The system defined in claim 10 further comprising a 

been described processing unit coupled to the document storage for remov- 

We claim: 15 ing the document from document storage. 

1. A document processing system comprising: 15. The system defined in claim 10 further comprising a 
a server subsystem storing an electronic version of infor- print engine to create the document. 

mation corresponding to a document containing human 16- The system defined in claim 15 wherein the print 

readable information and machine readable informa- engine creates the document by encoding pixel information 

tion that corresponds, at least in part, to the human 20 for verifying the human readable information, 

readable information; 17. The system defined in claim 1 wherein the client 

a client subsystem that scans both the human readable subsystem comprises a document scanner to read the 

information and the machine readable information in document, interpret the machine readable information, and 

response to receipt of the document and interprets the t0 contact ^ seiver subsystem; and 

machine readable information, wherein the client sub- 25 a communication interface for sending queries to the 

system uses information in the document to contact the server subsystem and receiving responses to those 

server subsystem to request verification of information queries from the client subsystem 

in the document; and 18. The system defined in claim 1 wherein the commu- 

a communications network coupled to the server sub- nications network comprises the World Wide Web (the 

system and the client subsystem for exchanging infor- 30 WeD )- 

mation therebetween ^ Tne system defined in claim 1 wherein the client 

wherein the server subsystem verifies the information on subsystem scans at least a portion of the document infor- 

the document based on a comparison between a portion m f on and cornmumcates said information to the server 

of the information on the document provided by the „ su ^! m to eaabl * c ° m ? 1 ? Uon ? f verification, 

client subsystem and the electronic version and, there- 35 ™ e s ^ em ned in claim 19 wherein the server 

after provides an authentication indication to the client sub jf 5* P^orrns document change detection, 

subsystem once verification has been concluded. u 21 ™ e s y stem in clabu 20 wherein the amount of 

2. The system defined in claim 1 wherein the machine change required to indicate that the document has been 
readable information comprises a bar code. changed is tunable 

3. The system defined in claim 1 wherein the machine 40 A ?^. Thc ****** dcfin f d ™ c]sam , 21 whcrcui * c 
readable information comprises encrypted information. ^55^ 15 tUBed b ^ d ?. US T ? d !f? 0n : . « 

4. The system defined in claim 1 wherein the document P' Thc ****** defined in claim 20 wherein the server 
comprises a prescription. subsystem performs document change detection by comput- 

5. Thc system defined in claim 1 wherein the machine ™& a nrst Checl^um over a plurality of blocks of said at 
readable information includes an identifier indicating an 45 ^t a portion of the documen t information and a second 
address of the server Checksum computed over blocks of said at least a portion 

6. The system defined in claim 1 wherein the server j? *• *»* ° f * e d f cum ^ "»* comparing the 
subsystem comprises a print engine to generate the docu- &st and f econd Checksums for a difference wherein the 
ment server subsystem detects a change when a difference is 

7. The system defined in claim 6 wherein the print engine 50 J«ermined » between the first and second Check- 
encodes pixel information corresponding to the document in bums. . 

the machine readable information. 24 A method far 1™°"™* a document having both 

8. The system defined in claim 7 wherein the pixel rcadablc jf ^ mation and^cruaerea^dableinforma- 
information indicates the number of pixels in the human « ^n specific to me document and corresponding, in part, to 
readable information human readable information, said method comprising 

9. The system defined in claim 7 wherein the pixel me ste P* ot 
information comprises location data indicating the location scanning the document; 

of pixels on the document to be used in verification. a first subsystem interpreting the machine readable inf or- 

10. The system defined in claim 1 wherein the server ^ mation in the document; 

subsystem comprises: the first subsystem contacting, using information in the 

a document storage for storing the electronic version of document, a second subsystem over a network to verify 

the document; information in the document using the human readable 

a document coordinator for servicing requests from the information and the machine readable information; 

client subsystem; and 65 the second subsystem verifying Mormation in the docu- 

communications facilities coupled to the document coor- ment in response to information provided by the first 

dinator and the network for receiving requests from the subsystem; and 
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IS-nemethoddelkedinclaimMfurth^comprisingthe S 7 ^ * e secood 

step of generating the document so that the machine read- su ° s ? ,5tem Performing verification using the electronic copy 

able information tracks the human readable inf ormation s mfonnation received from interpretation of the machine 

26. Themethoddefinedinclaim24fiirthercomprisingme readable information. 

step of preventing re-verification of the document of the 30 - ^ method defined in claim 29 further comprising the 

,u^«.. ste Pofti«secondsubsystemdetectingchange S betweenthe 

27. The method defined in claim 26 wherein the step of electronic copy and information received from interoretation 
verifying comprises comparing the filled-in information on 10 of the machine readable information and humanVeadabk 

step of locating human readable information in the docu- 

ment based on other information contained in the document * * * * 
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